
#
#   Time-Based Blind SQL injection support for MySQL/MariaDB
#
class Msf::Exploit::SQLi::MySQLi::TimeBasedBlind < Msf::Exploit::SQLi::MySQLi::Common
  include ::Msf::Exploit::SQLi::TimeBasedBlindMixin

  #
  # This method checks if the target is vulnerable to Blind time-based injection by checking if
  # the target sleeps only when a given condition is true, and doesn't when it's false.
  # @return [Boolean] Whether the check confirmed that the time-based SQL injection works
  #
  def test_vulnerable
    out_true = blind_request("if(1=1,sleep(#{datastore['SqliDelay']}),0)")
    out_false = blind_request("if(1=2,sleep(#{datastore['SqliDelay']}),0)")
    out_true && !out_false
  end
end
